Supporting Information Governance through Records and Information Management

Transcription

1 Supporting Information Governance through Records and Information Management Research Bulletin April 8, 2014 Joanne Kaczmarek, University of Illinois at Urbana-Champaign Overview The expanding scope of IT initiatives in higher education institutions now goes well beyond basic desktop and enterprise applications. IT is often asked to focus on efforts to establish good information-governance practices. A recent Gartner report recommends that IT align its internal information-governance efforts with those of the entire institution. 1 The many aspects of information governance are often found in a records and information management (RIM) program, but not all colleges and universities have such programs. RIM services have been an ancillary area of business concern in higher education, often embedded in the campus archives. In this structure, the typical approach is to allocate resources to creating recordsretention schedules and disposing of records but little to anything else. RIM programs should support good business practices through the effective management of an organization s records and other information assets. While the benefits of having a RIM program may not be well understood by higher education, increasing concerns about the loss or misuse of information have brought its essence information governance to the attention of many administrators. Components of good information governance include creating information- or data-security plans, developing business continuity plans, and addressing access controls to information. The focus of RIM has always been to support better business processes, ensuring that the right records are retained for the right period of time and are managed in a way that assures their accuracy and evidential value. RIM as a profession grew as paper-duplication capabilities expanded. Even before desktop computing and printing became available, the ease with which documents could be duplicated underscored the need to identify the official records of any particular business transaction or decision-making process. Today, seemingly endless growth in the creation of electronic documents and administrative data continues to create challenges for the business office environment. New technologies continue to offer ways to create more information and store it across a myriad of repository environments. Fundamental to good business practices is the concept of effective management of information assets. But defining and applying effective management across the enterprise is not always clear or easy. 2 Nonetheless, a good information-governance strategy can be assumed to incorporate effective practices for information management. A RIM program can provide additional support to IT professionals involved in information governance at their institution. A RIM program that works both with IT and the campus archivists can ensure that records with long-term value are not inadvertently lost and are when appropriate transferred to the university archives EDUCAUSE and Joanne Kaczmarek. CC by-nc-nd. 1

2 This research bulletin explains how information governance is at the core of a RIM program and how IT interests in information governance can be better supported by having a RIM program. It describes how the University of Illinois embedded a RIM program in the Office of the CIO, keeping close ties to the campus archivists, and how this arrangement benefits both information governance and the academic mission of the institution. If a RIM program is positioned in the office of the CIO, the services of the program can also enhance ongoing IT information-governance efforts. Highlights IT professionals in higher education now engage in initiatives that call for people skills and administrative talent at least as much as technical aptitude. One such initiative is establishing or expanding an information governance structure. According to a Gartner blog, information governance involves the specification of decision rights and an accountability framework to encourage desirable behavior in the valuation, creation, storage, use, archival and deletion of information. It includes the processes, roles, standards, and metrics that ensure the effective and efficient use of information in enabling an organization to achieve its goals. 3 Specific initiatives involving information governance might include developing risk-management or business continuity plans and establishing policies and procedures for data security and access. This kind of work is at the heart of the RIM profession. RIM programs should support good business practices through the effective management of an organization s records and other information assets. Prior to the introduction of computing technologies, effective management of information assets involved the application of conventional paper-filing techniques. These techniques included the use of office space designated as central files for reference materials and the application of controls on access to those files. Cross-filing schemes were created for easy information retrieval. Today, with computing and information technologies embedded in nearly every aspect of business processes, the ways information is created and stored have changed dramatically. At the same time, the need for the effective management of records and other information assets remains. The management of records in particular involves keeping track of where records vital to the continuation of core business functions are stored and ensuring they are accessible in an emergency; protecting all records from corruption (intentional or accidental); ensuring that proper access controls to the records are in place; periodically assessing the systems used to access and store the records and updating those systems as needed; providing assurances that records are retained only as long as needed or required; and providing oversight for the purging and destruction of records no longer needed. RIM functions can augment business continuity planning (BCP) and data-security and integrity initiatives. A common component of BCP is the clear documentation of where critical information (called vital records in the RIM environment) resides and who has what responsibilities for protecting it and making it available. A dedicated RIM program can provide support to the business owners of institutional records who have responsibility for their care. A 2

3 RIM program can also help standardize how the institution s records and other information assets are managed across the enterprise, identifying where standard practices are the best approach. A RIM program will go beyond records identification, management, and disposition and will also support improvements in business processes and good administrative datamanagement practices (see figure 1). Moreover, without controls for access to records and to the data from which they are generated, it is essentially impossible to trust the reliability of the records. A RIM program shares common concerns about data security and integrity. Figure 1. Business Continuity and RIM Many businesses and some higher education institutions have designated RIM programs. In higher education, records retention and disposal are often the only functions actively supported in a RIM program. These functions are also usually embedded in the archives, where they are taken on as additional responsibilities beyond the primary role of the archives. This organizational structure is understandable insofar as oversight by the archives may ensure that records with long-term value are not accidentally lost or destroyed. Focusing on these functions through the archives, however, loses much of the potential value of a RIM program. A fully supported RIM program with ties to the campus archives but reporting through the Office of the CIO can bring more benefits to the institution. The RIM program can help departments accomplish their work more effectively by providing training and best practices for managing information assets. Conversations between RIM professionals and departments can identify information that is duplicated, and this clarification gives staff a degree of comfort about reducing the amount of unnecessary information retained in various systems and repositories. Additionally, when institutional records with long-term value are identified, the RIM program can work with the archivists to garner support for the preservation of the records. Historic records 3

4 are valuable resources for administrators seeking an understanding of the past decisions of their offices or of the development of their academic programs. Historic records also provide value to advancement officers seeking support from alumni, as well as to academic researchers engaged in documenting the history of the institution. Beginnings of a RIM Program The University of Illinois at Urbana-Champaign Archives, established in 1963, quickly incorporated the standard practice of scheduling university records for disposal or transfer to the archives. This practice is a common component of a RIM program and is a means to build the holdings of an institution s archives. Many university archives incorporate this aspect of RIM into the operations of their archives. But the records scheduling and disposal components of RIM alone do not address the active management of information assets from the point of their creation, and such management has long been seen as necessary for the reliability and longterm preservation of born-digital records. Managing records includes ensuring they are reliable, protected against accidental or intentional corruption or loss, and disposed of in compliance with all applicable laws and regulations. As noted above, other aspects of a RIM program include providing guidance on streamlining business processes and managing records throughout their life cycle. The life cycle typically begins at the point of creation and continues through stages of active and reference use to an inactive state, when records should be purged and disposed of or preserved for the long term. When the University of Illinois committed to rolling out the Banner enterprise system, the archivist for the Urbana-Champaign campus campaigned for including a preservation component for records with long-term value. At the time, this request was considered out of scope and the archivist focused efforts instead on establishing a permanent position, archivist for electronic records. This position would be responsible for working with departments to identify electronic records having long-term value. In the absence of a RIM program, awareness of the value of records beyond their immediate administrative use was minimal and support for a digital repository did not exist. To build support for records having long-term value, the archives prioritized building support for a fully funded RIM program. The catalyst to launch a RIM program came as a request from the campus architect. The request was for the archives to take responsibility for curating historically significant original linen drawings and sketches of campus buildings. The materials are part of a larger collection of drawings and other project files that are typically found in the custodial care of the Planning Resources unit of the campus Department of Facilities and Services. All materials had been created in the normal course of building construction, maintenance, and remodeling projects. Because drawings of buildings that are still standing are considered active records, the archives was reluctant to take on custodial responsibilities for a subset of the whole, especially without funding to properly conserve and rehouse them. Discussions about the current location and management of the Facilities and Services records revealed similar records related to the operations of the campus power plant also in jeopardy. Again, because the power plant equipment and core components remain in operation for a long period of time, even records that the archives would identify as having archival value often continue to have value for current business operations. In other words, the records can remain active for a very long period of time even if they have obvious value to researchers as historical artifacts. 4

5 The archives proposed several project-based initiatives to help both the power plant and the facilities and services department have better control over records needed for daily operations. These projects provided an opportunity to demonstrate the value of intentionally managing departmental records without requiring a commitment of long-term funding. The projects also addressed the preservation needs of the historically significant records. Upon successful completion of the projects, the archives had gained recognition for bringing direct administrative support to several critical units on campus, focusing first on their need to identify and find critical information supportive of campus infrastructure operations. This recognition provided an opportunity to work with the Office of Business and Financial Services (OBFS). For the OBFS, the project goals were focused on training and awareness and on identifying records versus nonrecords. All three of these projects involved a one-year financial commitment with the option to renew for subsequent years. Commitment levels were enough to support at least one FTE per year, with some budget for travel, training, and supplies. The immediate objectives of the projects included records inventorying, records indexing, special library creation, document salvaging and preservation, web portal creation, electronic records filing, records disposal, and the creation of a shared archival repository of active business records. In all cases the funding was provided for more than one year, with two projects spanning three subsequent years. These projects played a significant role in securing buy-in for the RIM program by demonstrating the value of focused efforts to gain better control over information assets and by bringing more awareness to the campuses about RIM. Through the course of the projects, the archives gained a foothold in discussions with administrators regarding the need to develop a sustainable model for a RIM program. In 2009, a growing interest in establishing policies, best practices, and recommendations for managing electronic communications took root. This interest was met with a call for a university-wide task force, which was overseen by the university s CIO and was charged with making recommendations for establishing an effective RIM program. Simultaneously, a similar task force was launched on the university s Chicago campus. Both task forces worked in close alignment to provide compatible recommendations. By December 2010, recommendations were in place to support a university-wide RIM program. By December 2011, support was agreed to and the process of structuring the program and filling the positions began. The Office of Records and Information Management Services (RIMS) was officially launched in April The Structure and Accomplishments of RIMS The governance structure for RIMS includes a RIMS Policy Advisory Committee with representatives from each of the three main campuses of the university. Representation spans functional areas such as business and finance, facilities, security, IT, the medical center, faculty and research, senior administrative offices, and legal counsel. The RIMS group is charged with creating and overseeing all aspects of an effective RIM program. This includes interfacing with experts in areas related to records and data security, business-process improvement, business continuity planning, and risk management. Support for the program is shared across the campuses and central administration, and the program includes four full-time and two part-time RIM professionals. 5

6 During the first two years of the program, standard practices for the retention and disposal of records have been put in place, and institution-wide retention schedules based on common functional categories have been created to replace department-specific schedules. By coordinating records retention and disposal across the institution, the university has reclaimed office and storage space of over 5,000 cubic feet and over 4 TB of electronic storage for the same period. Basic training and job-aid resources have been created and delivered to bring more awareness to the university community about records and information management. RIMS team members have also participated in the Illinois State Archives E-Records Working Group, which is responsible for changes in the Illinois Administrative Code to allow for electronic-only storage of records requiring retention longer than 10 years. This change has provided relief from the long-standing burden of storing records in paper formats. RIMS team members and various IT groups meet regularly. These meetings provide a platform to ask and answer questions about data-storage and records-retention requirements. IT personnel often do not feel comfortable asking their customers if they really need indefinite access to particular electronically stored documents and data. RIMS personnel are well positioned to offer assistance in these areas. In many instances, departments ask for help scanning hard-copy materials and storing them on shared drives or some other designated storage environment. Sometimes there is no longer a need or requirement for retaining the materials, either in hard-copy or electronic format. Through ongoing discussions between IT and RIMS personnel, recommendations are being put forth to guide departments regarding document imaging. As departments prepare to either purge old paper files or embark on large document-imaging projects, RIMS is able to provide guidance. In some cases the archivists assess the long-term value of the paper records and provide advice about scanning the materials. Sometimes, due to the condition of the paper or the minimal content value, scanning is not recommended. Because RIMS reports through the Office of the CIO, RIMS team members participate in strategic planning meetings related to the IT services offered to the institution. With the next upgrade for SharePoint, the implementation team is considering including Content Type templates created by RIMS for use in storing official records. The hope is that by using these templates, departments using SharePoint will be better able to manage and purge their records. The creation of similar templates is planned for use with other electronic documentstorage options offered across the institution. Successful information-governance initiatives require a commitment to review current practices, recommend changes as appropriate, and implement those changes. Including a RIM program in higher education institutions can enhance the outcome of such initiatives. If a RIM program is positioned in the Office of the CIO, the services of the program can also enhance ongoing IT information-governance efforts. What It Means to Higher Education A common mission of higher education institutions is to support teaching and learning, research, and service. Because of the diversity of programs of study and approaches to research, variations are essential in how IT services are deployed to support the institution. But in the area of information governance, variability is not desirable. Consistent management and security practices are the goal. 6

7 A coordinated approach to information governance should be a core objective of a RIM program. Dedicating resources to support a RIM program will ensure that professionals will be available to create and deliver training materials and to communicate good informationmanagement practices. A RIM program should also provide support to the institution regarding compliance requirements related to the retention and purging of records. In higher education, a RIM program often exists within the university archives division, where the reach of the program may vary widely. University archives are primarily interested in institutional records with long-term value, and therefore many aspects of a RIM program in the archives are not able to garner full support. Because nearly all business processes today begin and end with electronic data and documents, providing full support for a RIM program within the Office of the CIO may be most effective. Team members of a RIM program will often be first on the scene when departments seek support for the disposal or moving of documents. By working closely with the archivists, RIM personnel can reduce the efforts needed by the archivists to review administrative records. Identifying records early that are appropriate for long-term preservation can reduce the level of accidental purging. This, in turn, can increase the documentary materials available to support a more fulsome record of the history of the institution. Many administrators have embarked on large-scale projects to digitize administrative records. The infrastructures being created to preserve research data and digital library materials may also support these administrative records. At a fundamental level, the needs for digital preservation are the same regardless of the content or the source of the digital objects. A RIM program closely aligned with the Office of the CIO can create a natural platform for engagement between IT, administration, and academics. Getting Buy-In Getting buy-in for a RIM program requires a vision for the long-term management of information assets, a commitment to creative problem solving, and a willingness to work collaboratively across business and reporting lines. Long-Range Plan and Compliance When garnering support for a RIM program, expect to be in it for the long term. For the University of Illinois, persistent and consistent efforts spanned an eight-year period. The university is considered a state agency and therefore is required to comply with the Illinois State Records Act. This law requires each agency to have an efficiently run records-management program. By creating the RIMS program, the university was immediately in greater compliance with the law and is better positioned to improve compliance overall. Creative Problem Solving Be willing to work outside your comfort zones and help strategic units solve informationmanagement problems that might normally seem out of scope. Be willing to reach out to departments looking to increase usable space in existing buildings or to reduce the storage of unnecessary redundant data. Collaborative Approach Understand the need to leverage existing expertise and initiatives within the institution. Initiate dialogue around points of intersecting interests in advance of the launch of a RIM program. 7

8 Existing initiatives surrounding business continuity planning, data security and data integrity, and document imaging are good places to start. Challenges The greatest challenges to establishing an effective RIM program relate to the cultural climate of the institution. Inconsistent Institutional Vision It is best if the institution as a whole has a vision for how it is moving into the future. If a large number of senior administrative positions turn over in a short period of time, consistency is difficult and support for a RIM program may wax and wane. Crisis-Management Mind-Set With gaps in leadership or significant negative external forces (e.g., economic downturns), administrators are forced toward a crisis-management mind-set that in turn reduces the likelihood of their support for new initiatives. Administrative Bloat Because a RIM program is seen as primarily supporting administrative operations, support for it can appear to be an unnecessary increase in administrative overhead if the benefits are not clearly outlined. Key Questions to Ask What is your institution s information-governance structure? Does your institution currently have a RIM program, and if so, how is it integrated into your information-governance structure? What initiatives related to the management of information assets are supported by IT services, and what kind of support is provided? How is your institution proactively demonstrating compliance with legal and regulatory requirements related to institutional records? How well documented is the administrative history of your institution and is it available to both administrative units and academic researchers? Where to Learn More ARMA International, Generally Accepted Recordkeeping Principles, ARMA International, Setting the Standard(s) And Best Practices for Information Governance, International Organization for Standardization, :2001 Information and Documentation Records Management Part 1: General, and ISO :2001 Information and Documentation Records Management Part 2: Guidelines. 8

9 About the Author Joanne Kaczmarek is Archivist for Electronic Records at the University of Illinois at Urbana- Champaign and Director of Records and Information Management Services. Citation for This Work Kaczmarek, Joanne. Supporting Information Governance through Records and Information Management. Research bulletin. Louisville, CO: ECAR, April 8, Available from Notes 1. Ted Friedman and Tom Scholtz, Align Information Security Governance with Your Broader Information Governance Initiatives, Gartner report, August 19, 2013, ID: G Terry Hanson, Making the Case for the Information Strategy, research bulletin (Boulder, CO: ECAR, 2011), available from 3. Debra Logan, What Is Information Governance? And Why Is It So Hard? Gartner blog, January 11, 2010, 9